Add note about cross domain policies